<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
	<title>Rollup search limitations | ElasticSearch 7.7 权威指南中文版</title>
	<meta name="keywords" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <meta name="description" content="ElasticSearch 权威指南中文版, elasticsearch 7, es7, 实时数据分析，实时数据检索" />
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
	<link rel="stylesheet" type="text/css" href="../static/styles.css" />
	<script>
	var _link = 'rollup-search-limitations.html';
    </script>
</head>
<body>
<div class="main-container">
    <section id="content">
        <div class="content-wrapper">
            <section id="guide" lang="zh_cn">
                <div class="container">
                    <div class="row">
                        <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                            <div style="color:gray; word-break: break-all; font-size:12px;">原英文版地址: <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.7/rollup-search-limitations.html" rel="nofollow" target="_blank">https://www.elastic.co/guide/en/elasticsearch/reference/7.7/rollup-search-limitations.html</a>, 原文档版权归 www.elastic.co 所有<br/>本地英文版地址: <a href="../en/rollup-search-limitations.html" rel="nofollow" target="_blank">../en/rollup-search-limitations.html</a></div>
                        <!-- start body -->
                  <div class="page_header">
<strong>重要</strong>: 此版本不会发布额外的bug修复或文档更新。最新信息请参考 <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/index.html" rel="nofollow">当前版本文档</a>。
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="data-rollup-transform.html">Roll up or transform your data</a></span>
»
<span class="breadcrumb-link"><a href="xpack-rollup.html">Rolling up historical data</a></span>
»
<span class="breadcrumb-node">Rollup search limitations</span>
</div>
<div class="navheader">
<span class="prev">
<a href="rollup-agg-limitations.html">« Rollup aggregation limitations</a>
</span>
<span class="next">
<a href="transforms.html">Transforming data »</a>
</span>
</div>
<div class="section xpack">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="rollup-search-limitations"></a>Rollup search limitations<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/rollup/rollup-search-limitations.asciidoc">edit</a><a class="xpack_tag" href="https://www.elastic.co/subscriptions"></a>
</h2>
</div></div></div>
<div class="warning admon">
<div class="icon"></div>
<div class="admon_content">
<p>This functionality is experimental and may be changed or removed completely in a future release. Elastic will take a best effort approach to fix any issues, but experimental features are not subject to the support SLA of official GA features.</p>
</div>
</div>
<p>While we feel the Rollup function is extremely flexible, the nature of summarizing data means there will be some limitations.  Once
live data is thrown away, you will always lose some flexibility.</p>
<p>This page highlights the major limitations so that you are aware of them.</p>
<h4>
<a id="_only_one_rollup_index_per_search"></a>Only one rollup index per search<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/rollup/rollup-search-limitations.asciidoc">edit</a>
</h4>
<p>When using the <a class="xref" href="rollup-search.html" title="Rollup search">Rollup search</a> endpoint, the <code class="literal">index</code> parameter accepts one or more indices.  These can be a mix of regular, non-rollup
indices and rollup indices.  However, only one rollup index can be specified.  The exact list of rules for the <code class="literal">index</code> parameter are as
follows:</p>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
At least one index/index-pattern must be specified.  This can be either a rollup or non-rollup index.  Omitting the index parameter,
or using <code class="literal">_all</code>, is not permitted
</li>
<li class="listitem">
Multiple non-rollup indices may be specified
</li>
<li class="listitem">
Only one rollup index may be specified.  If more than one are supplied an exception will be thrown
</li>
<li class="listitem">
Index patterns may be used, but if they match more than one rollup index an exception will be thrown.
</li>
</ul>
</div>
<p>This limitation is driven by the logic that decides which jobs are the "best" for any given query.  If you have ten jobs stored in a single
index, which cover the source data with varying degrees of completeness and different intervals, the query needs to determine which set
of jobs to actually search.  Incorrect decisions can lead to inaccurate aggregation results (e.g. over-counting doc counts, or bad metrics).
Needless to say, this is a technically challenging piece of code.</p>
<p>To help simplify the problem, we have limited search to just one rollup index at a time (which may contain multiple jobs).  In the future we
may be able to open this up to multiple rollup jobs.</p>
<h4>
<a id="aggregate-stored-only"></a>Can only aggregate what’s been stored<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/rollup/rollup-search-limitations.asciidoc">edit</a>
</h4>
<p>A perhaps obvious limitation, but rollups can only aggregate on data that has been stored in the rollups.  If you don’t configure the
rollup job to store metrics about the <code class="literal">price</code> field, you won’t be able to use the <code class="literal">price</code> field in any query or aggregation.</p>
<p>For example, the <code class="literal">temperature</code> field in the following query has been stored in a rollup job…​ but not with an <code class="literal">avg</code> metric.  Which means
the usage of <code class="literal">avg</code> here is not allowed:</p>
<div class="pre_wrapper lang-console">
<pre class="programlisting prettyprint lang-console">GET sensor_rollup/_rollup_search
{
    "size": 0,
    "aggregations": {
        "avg_temperature": {
            "avg": {
                "field": "temperature"
            }
        }
    }
}</pre>
</div>
<div class="console_widget" data-snippet="snippets/1153.console"></div>
<p>The response will tell you that the field and aggregation were not possible, because no rollup jobs were found which contained them:</p>
<div class="pre_wrapper lang-console-result">
<pre class="programlisting prettyprint lang-console-result">{
    "error" : {
        "root_cause" : [
            {
                "type" : "illegal_argument_exception",
                "reason" : "There is not a rollup job that has a [avg] agg with name [avg_temperature] which also satisfies all requirements of query.",
                "stack_trace": ...
            }
        ],
        "type" : "illegal_argument_exception",
        "reason" : "There is not a rollup job that has a [avg] agg with name [avg_temperature] which also satisfies all requirements of query.",
        "stack_trace": ...
    },
    "status": 400
}</pre>
</div>
<h4>
<a id="_interval_granularity"></a>Interval granularity<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/rollup/rollup-search-limitations.asciidoc">edit</a>
</h4>
<p>Rollups are stored at a certain granularity, as defined by the <code class="literal">date_histogram</code> group in the configuration.  This means you
can only search/aggregate the rollup data with an interval that is greater-than or equal to the configured rollup interval.</p>
<p>For example, if data is rolled up at hourly intervals, the <a class="xref" href="rollup-search.html" title="Rollup search">Rollup search</a> API can aggregate on any time interval
hourly or greater.  Intervals that are less than an hour will throw an exception, since the data simply doesn’t
exist for finer granularities.</p>
<div class="sidebar">
<a id="rollup-search-limitations-intervals"></a>
<div class="titlepage"><div><div>
<p class="title"><strong>Requests must be multiples of the config</strong></p>
</div></div></div>
<p>Perhaps not immediately apparent, but the interval specified in an aggregation request must be a whole
multiple of the configured interval.  If the job was configured to rollup on <code class="literal">3d</code> intervals, you can only
query and aggregate on multiples of three (<code class="literal">3d</code>, <code class="literal">6d</code>, <code class="literal">9d</code>, etc).</p>
<p>A non-multiple wouldn’t work, since the rolled up data wouldn’t cleanly "overlap" with the buckets generated
by the aggregation, leading to incorrect results.</p>
<p>For that reason, an error is thrown if a whole multiple of the configured interval isn’t found.</p>
</div>
<p>Because the RollupSearch endpoint can "upsample" intervals, there is no need to configure jobs with multiple intervals (hourly, daily, etc).
It’s recommended to just configure a single job with the smallest granularity that is needed, and allow the search endpoint to upsample
as needed.</p>
<p>That said, if multiple jobs are present in a single rollup index with varying intervals, the search endpoint will identify and use the job(s)
with the largest interval to satisfy the search request.</p>
<h4>
<a id="_limited_querying_components"></a>Limited querying components<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/rollup/rollup-search-limitations.asciidoc">edit</a>
</h4>
<p>The Rollup functionality allows <code class="literal">query</code>'s in the search request, but with a limited subset of components.  The queries currently allowed are:</p>
<div class="ulist itemizedlist">
<ul class="itemizedlist">
<li class="listitem">
Term Query
</li>
<li class="listitem">
Terms Query
</li>
<li class="listitem">
Range Query
</li>
<li class="listitem">
MatchAll Query
</li>
<li class="listitem">
Any compound query (Boolean, Boosting, ConstantScore, etc)
</li>
</ul>
</div>
<p>Furthermore, these queries can only use fields that were also saved in the rollup job as a <code class="literal">group</code>.
If you wish to filter on a keyword <code class="literal">hostname</code> field, that field must have been configured in the rollup job under a <code class="literal">terms</code> grouping.</p>
<p>If you attempt to use an unsupported query, or the query references a field that wasn’t configured in the rollup job, an exception will be
thrown.  We expect the list of support queries to grow over time as more are implemented.</p>
<h4>
<a id="_timezones"></a>Timezones<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/rollup/rollup-search-limitations.asciidoc">edit</a>
</h4>
<p>Rollup documents are stored in the timezone of the <code class="literal">date_histogram</code> group configuration in the job.  If no timezone is specified, the default
is to rollup timestamps in <code class="literal">UTC</code>.</p>
</div>
<div class="navfooter">
<span class="prev">
<a href="rollup-agg-limitations.html">« Rollup aggregation limitations</a>
</span>
<span class="next">
<a href="transforms.html">Transforming data »</a>
</span>
</div>
</div>

                  <!-- end body -->
                        </div>
                        <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                        
                        </div>
                    </div>
                </div>
            </section>
        </div>
    </section>
</div>
<script src="../static/cn.js"></script>
</body>
</html>